jeopi-cli 16.2.23 → 16.2.25

package/src/advisor/__tests__/advisor.test.ts

@@ -26,6 +26,7 @@ import {
 	isAdvisorInterruptImmuneTurnActive,
 	isAdvisorTranscriptName,
 	isInterruptingSeverity,
+	isRefusalError,
 	resolveAdvisorDeliveryChannel,
 	type WatchdogConfigDoc,
 } from "..";
@@ -1312,6 +1313,178 @@ describe("advisor", () => {
 			expect(state.messages).toHaveLength(2);
 		});
 
+		it("strips thinking and retries once when the provider refuses the payload (reasoning_extraction)", async () => {
+			const promptInputs: string[] = [];
+			const strippedNotices: number[] = [];
+			let refuseNext = true;
+			const agent: AdvisorAgent = {
+				prompt: async input => {
+					promptInputs.push(input);
+					if (refuseNext) {
+						refuseNext = false;
+						throw new Error(
+							"Refusal (reasoning_extraction): This request was blocked as it seems to violate Anthropic's Terms of Service restrictions on reverse engineering or duplicating model outputs.",
+						);
+					}
+				},
+				abort: () => {},
+				reset: () => {},
+				state: { messages: [] },
+			};
+			const thinking = "secret chain of thought the classifier flags";
+			const messages: AgentMessage[] = [
+				{ role: "user", content: "do the thing", timestamp: 1 } as AgentMessage,
+				{
+					role: "assistant",
+					content: [
+						{ type: "thinking", thinking },
+						{ type: "text", text: "done" },
+					],
+					timestamp: 2,
+				} as AgentMessage,
+			];
+			const host: AdvisorRuntimeHost = {
+				snapshotMessages: () => messages,
+				enqueueAdvice: () => {},
+				notifyThinkingStripped: () => strippedNotices.push(1),
+			};
+			const runtime = new AdvisorRuntime(agent, host, 0);
+
+			runtime.onTurnEnd(messages);
+			await Bun.sleep(0);
+			await Bun.sleep(0);
+
+			// First attempt carried thinking; the refusal triggered exactly one
+			// stripped re-render instead of a blind identical retry.
+			expect(promptInputs).toHaveLength(2);
+			expect(promptInputs[0]).toContain("_thinking:_");
+			expect(promptInputs[0]).toContain(thinking);
+			expect(promptInputs[1]).not.toContain("_thinking:_");
+			expect(promptInputs[1]).not.toContain(thinking);
+			expect(promptInputs[1]).toContain("done");
+			expect(strippedNotices).toHaveLength(1);
+			expect(runtime.backlog).toBe(0);
+
+			// Thinking stays latched off for subsequent turns.
+			messages.push({
+				role: "assistant",
+				content: [
+					{ type: "thinking", thinking: "later thoughts" },
+					{ type: "text", text: "next" },
+				],
+				timestamp: 3,
+			} as AgentMessage);
+			runtime.onTurnEnd(messages);
+			await Bun.sleep(0);
+			expect(promptInputs).toHaveLength(3);
+			expect(promptInputs[2]).not.toContain("later thoughts");
+			expect(strippedNotices).toHaveLength(1);
+		});
+
+		it("skips the degrade path when thinking is disabled at construction and falls through to the watchdog", async () => {
+			const promptInputs: string[] = [];
+			const strippedNotices: number[] = [];
+			const failures: unknown[] = [];
+			const agent: AdvisorAgent = {
+				prompt: async input => {
+					promptInputs.push(input);
+					throw new Error("Refusal (reasoning_extraction): blocked");
+				},
+				abort: () => {},
+				reset: () => {},
+				state: { messages: [] },
+			};
+			const messages: AgentMessage[] = [
+				{ role: "user", content: "start", timestamp: 1 } as AgentMessage,
+				{
+					role: "assistant",
+					content: [
+						{ type: "thinking", thinking: "hidden reasoning" },
+						{ type: "text", text: "visible" },
+					],
+					timestamp: 2,
+				} as AgentMessage,
+			];
+			const host: AdvisorRuntimeHost = {
+				snapshotMessages: () => messages,
+				enqueueAdvice: () => {},
+				notifyFailure: error => failures.push(error),
+				notifyThinkingStripped: () => strippedNotices.push(1),
+			};
+			const runtime = new AdvisorRuntime(agent, host, 0, { includeThinking: false });
+
+			runtime.onTurnEnd(messages);
+			await Bun.sleep(0);
+			await Bun.sleep(0);
+			await Bun.sleep(0);
+
+			// Thinking never rendered, so there is nothing to strip: the refusal is
+			// handled by the normal 3-strike watchdog, not an infinite degrade loop.
+			expect(promptInputs).toHaveLength(3);
+			for (const input of promptInputs) {
+				expect(input).not.toContain("hidden reasoning");
+			}
+			expect(strippedNotices).toHaveLength(0);
+			expect(failures).toHaveLength(1);
+			expect(runtime.backlog).toBe(0);
+		});
+
+		it("trips the watchdog when refusals persist after the thinking strip", async () => {
+			const promptInputs: string[] = [];
+			const strippedNotices: number[] = [];
+			const failures: unknown[] = [];
+			const agent: AdvisorAgent = {
+				prompt: async input => {
+					promptInputs.push(input);
+					throw new Error("Refusal (reasoning_extraction): still blocked");
+				},
+				abort: () => {},
+				reset: () => {},
+				state: { messages: [] },
+			};
+			const messages: AgentMessage[] = [
+				{ role: "user", content: "start", timestamp: 1 } as AgentMessage,
+				{
+					role: "assistant",
+					content: [
+						{ type: "thinking", thinking: "flagged reasoning" },
+						{ type: "text", text: "visible" },
+					],
+					timestamp: 2,
+				} as AgentMessage,
+			];
+			const host: AdvisorRuntimeHost = {
+				snapshotMessages: () => messages,
+				enqueueAdvice: () => {},
+				notifyFailure: error => failures.push(error),
+				notifyThinkingStripped: () => strippedNotices.push(1),
+			};
+			const runtime = new AdvisorRuntime(agent, host, 0);
+
+			runtime.onTurnEnd(messages);
+			for (let i = 0; i < 6; i++) await Bun.sleep(0);
+
+			// 1 refused attempt with thinking + 3 stripped attempts → watchdog drop.
+			// The strip fires exactly once; there is no auto-recovery loop.
+			expect(promptInputs).toHaveLength(4);
+			expect(promptInputs[0]).toContain("_thinking:_");
+			expect(promptInputs[1]).not.toContain("_thinking:_");
+			expect(strippedNotices).toHaveLength(1);
+			expect(failures).toHaveLength(1);
+			expect(runtime.backlog).toBe(0);
+		});
+
+		it("classifies pi-ai refusal message shapes without matching ordinary errors", () => {
+			expect(isRefusalError(new Error("Refusal (reasoning_extraction): blocked by ToS"))).toBe(true);
+			expect(isRefusalError(new Error("Refusal (no details provided)"))).toBe(true);
+			expect(isRefusalError(new Error("Refusal: something"))).toBe(true);
+			expect(isRefusalError(new Error("Refusal"))).toBe(true);
+			expect(isRefusalError("Error: Refusal (reasoning_extraction): blocked")).toBe(true);
+			expect(isRefusalError(new Error("404 No endpoints available"))).toBe(false);
+			expect(isRefusalError(new Error("Refusals are handled elsewhere"))).toBe(false);
+			expect(isRefusalError(new Error("stream timeout"))).toBe(false);
+		});
+
 		it("drops the in-flight batch when a reset aborts the advisor prompt", async () => {
 			const promptInputs: string[] = [];
 			const { promise: firstPromptStarted, resolve: startFirstPrompt } = Promise.withResolvers<void>();

package/src/advisor/runtime.ts

@@ -50,6 +50,8 @@ export interface AdvisorRuntimeHost {
 	beginAdvisorUpdate?(): void;
 	/** Surface a non-recovering advisor failure to the host UI without adding model-visible context. */
 	notifyFailure?(error: unknown): void;
+	/** Surface a one-time notice that thinking was stripped from advisor renders after a provider refusal. */
+	notifyThinkingStripped?(): void;
 }
 
 interface PendingDelta {
@@ -57,6 +59,28 @@ interface PendingDelta {
 	turns: number;
 }
 
+/** Construction-time tuning for {@link AdvisorRuntime}. */
+export interface AdvisorRuntimeOptions {
+	/** Render the primary's thinking blocks into advisor deltas (default true). */
+	includeThinking?: boolean;
+}
+
+/**
+ * Match the stable `Refusal` / `Refusal (…)` message prefix pi-ai emits for a
+ * provider classifier refusal (`stop_details.type === "refusal"` mapped in
+ * `packages/ai/src/providers/anthropic.ts`), e.g. Anthropic Fable's
+ * `Refusal (reasoning_extraction): This request was blocked …`. Refusals are
+ * payload-shape-bound: per Anthropic's refusal semantics, replaying the
+ * identical payload predictably re-refuses, so the drain loop must degrade the
+ * payload instead of blind-retrying it.
+ */
+const REFUSAL_MESSAGE_PREFIX = /^(?:Error:\s*)?Refusal(?:\s*\(|:|$)/;
+
+export function isRefusalError(error: unknown): boolean {
+	const message = error instanceof Error ? error.message : String(error);
+	return REFUSAL_MESSAGE_PREFIX.test(message.trim());
+}
+
 interface CatchupWaiter {
 	threshold: number;
 	resolve: () => void;
@@ -86,11 +110,24 @@ export class AdvisorRuntime {
 	#epoch = 0;
 	disposed = false;
 
+	/**
+	 * Render primary thinking into deltas. Doubles as the refusal-degrade latch:
+	 * starts `true` (or whatever the constructor option says) and flips to
+	 * `false` exactly once, the first time a classifier refusal is caught — see
+	 * the `#drain` catch block. That single flip is sufficient to both change
+	 * future renders AND guard against re-triggering the degrade path, so no
+	 * separate one-shot flag is needed alongside it.
+	 */
+	#includeThinking: boolean;
+
 	constructor(
 		private readonly agent: AdvisorAgent,
 		private readonly host: AdvisorRuntimeHost,
 		private readonly retryDelayMs = 1000,
-	) {}
+		options: AdvisorRuntimeOptions = {},
+	) {
+		this.#includeThinking = options.includeThinking ?? true;
+	}
 
 	get backlog(): number {
 		return this.#backlog;
@@ -205,7 +242,7 @@ export class AdvisorRuntime {
 		const obfuscator = this.host.obfuscator;
 		const formattedDelta = obfuscator?.hasSecrets() ? obfuscateAdvisorDelta(obfuscator, delta) : delta;
 		const md = formatSessionHistoryMarkdown(formattedDelta, {
-			includeThinking: true,
+			includeThinking: this.#includeThinking,
 			includeToolIntent: true,
 			watchedRoles: true,
 			expandPrimaryContext: true,
@@ -352,6 +389,33 @@ export class AdvisorRuntime {
 					if (this.#epoch !== epoch) continue;
 					this.#rollbackFailedTurn(messageSnapshot);
 					logger.debug("advisor turn failed", { err: String(err) });
+					// Classifier refusals (e.g. Anthropic Fable's `reasoning_extraction`,
+					// which flags harnesses that feed model thinking back as text) are
+					// payload-shape-bound: re-sending the identical batch predictably
+					// re-refuses. Degrade once — latch thinking off, re-prime, and requeue
+					// a re-rendered batch without thinking. Flipping `#includeThinking` to
+					// `false` here doubles as the one-shot guard: a refusal after the
+					// strip fails the `this.#includeThinking` check below and falls
+					// through to the normal consecutive-failure watchdog, so this cannot
+					// loop.
+					if (this.#includeThinking && isRefusalError(err)) {
+						this.#includeThinking = false;
+						const queuedTurns = this.#pending.reduce((sum, b) => sum + b.turns, 0);
+						this.#resetAdvisorContext(false, false);
+						const stripped = this.#renderDelta(this.#latestMessages);
+						try {
+							this.host.notifyThinkingStripped?.();
+						} catch (notifyErr) {
+							logger.warn("advisor thinking-strip notification failed", { err: String(notifyErr) });
+						}
+						if (stripped !== null) {
+							this.#pending.unshift({ text: stripped, turns: finalTurns + queuedTurns });
+						} else {
+							this.#backlog = Math.max(0, this.#backlog - (finalTurns + queuedTurns));
+							this.#notifyWaiters();
+						}
+						continue;
+					}
 					this.#consecutiveFailures++;
 					if (this.#consecutiveFailures >= 3) {
 						logger.warn("advisor failed consecutively 3 times; dropping backlog to prevent stall");

package/src/cli/update-cli.ts

@@ -303,6 +303,130 @@ export async function fetchNewerPublishedVersion(currentVersion: string): Promis
 	}
 }
 
+/** Minimal published GitHub release shape used by the update-notes and registry-lag helpers. */
+export interface GitHubReleaseSummary {
+	version: string;
+	body: string;
+}
+
+/** Cap on printed release-note lines so a many-versions-behind update does not flood the terminal. */
+const RELEASE_NOTES_MAX_LINES = 40;
+
+/**
+ * Parse a GitHub releases API response into {@link GitHubReleaseSummary}
+ * entries, keeping only published (non-draft, non-prerelease) releases whose
+ * tag matches the `vX.Y.Z` convention. Split out from {@link fetchGitHubReleases}
+ * so the response-shape handling is independently testable without a network
+ * call.
+ */
+export function parseGitHubReleases(data: unknown): GitHubReleaseSummary[] {
+	if (!Array.isArray(data)) return [];
+	const releases: GitHubReleaseSummary[] = [];
+	for (const entry of data as Array<{
+		tag_name?: unknown;
+		body?: unknown;
+		draft?: unknown;
+		prerelease?: unknown;
+	}>) {
+		if (entry.draft === true || entry.prerelease === true) continue;
+		const tag = typeof entry.tag_name === "string" ? entry.tag_name : "";
+		const match = tag.match(/^v(\d+\.\d+\.\d+)$/);
+		if (!match) continue;
+		releases.push({ version: match[1], body: typeof entry.body === "string" ? entry.body : "" });
+	}
+	return releases;
+}
+
+/**
+ * Fetch recent published releases for {@link REPO} from the GitHub API.
+ *
+ * Best-effort: `jeopi update` must never fail because release notes are
+ * unreachable, so network errors, rate limits, and shape surprises all
+ * resolve to an empty list. Only called on explicit `jeopi update` runs —
+ * the frequent startup notice keeps using the npm registry to avoid
+ * unauthenticated GitHub rate limits.
+ */
+async function fetchGitHubReleases(): Promise<GitHubReleaseSummary[]> {
+	try {
+		const response = await fetch(`https://api.github.com/repos/${REPO}/releases?per_page=30`, {
+			headers: { accept: "application/vnd.github+json", "user-agent": `${APP_NAME}-update` },
+		});
+		if (!response.ok) return [];
+		return parseGitHubReleases(await response.json());
+	} catch {
+		return [];
+	}
+}
+
+/**
+ * Collect release-note bodies for versions in `(currentVersion, targetVersion]`,
+ * newest first. Backs the "what changed" block `jeopi update` prints under the
+ * "New version available" line, so a user several versions behind sees every
+ * intervening release, not just the newest body.
+ */
+export function selectReleaseNotesInRange(
+	releases: readonly GitHubReleaseSummary[],
+	currentVersion: string,
+	targetVersion: string,
+): GitHubReleaseSummary[] {
+	return releases
+		.filter(
+			release =>
+				compareVersions(release.version, currentVersion) > 0 &&
+				compareVersions(release.version, targetVersion) <= 0,
+		)
+		.sort((a, b) => compareVersions(b.version, a.version));
+}
+
+/**
+ * Render selected release notes as plain indented text, capped at `maxLines`.
+ * HTML comments (release template scaffolding) are stripped; a truncated
+ * rendering ends with a pointer at the releases page.
+ */
+export function formatReleaseNotes(
+	notes: readonly GitHubReleaseSummary[],
+	maxLines: number = RELEASE_NOTES_MAX_LINES,
+): string {
+	const lines: string[] = [];
+	for (const note of notes) {
+		const body = note.body
+			.replace(/\r\n/g, "\n")
+			.replace(/<!--[\s\S]*?-->/g, "")
+			.trim();
+		lines.push(`v${note.version}`);
+		for (const bodyLine of body.split("\n")) {
+			if (body.length === 0) break;
+			lines.push(`  ${bodyLine}`);
+		}
+		lines.push("");
+	}
+	while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+	if (lines.length > maxLines) {
+		lines.length = maxLines;
+		lines.push(`  … full notes: https://github.com/${REPO}/releases`);
+	}
+	return lines.join("\n");
+}
+
+/**
+ * Detect a published GitHub release the npm registry has not served yet.
+ *
+ * When the release pipeline dies between the GitHub Release and the npm
+ * publish job (or npm credentials are missing so the publish silently
+ * no-ops), the npm `latest` this updater trusts stays behind while GitHub
+ * advances — and `jeopi update` would report "Already up to date" with no
+ * hint that a newer release exists. Returns the newest GitHub version
+ * strictly above `npmVersion`, else `undefined`.
+ */
+export function detectRegistryLag(npmVersion: string, releases: readonly GitHubReleaseSummary[]): string | undefined {
+	let newest: string | undefined;
+	for (const release of releases) {
+		if (compareVersions(release.version, npmVersion) <= 0) continue;
+		if (newest === undefined || compareVersions(release.version, newest) > 0) newest = release.version;
+	}
+	return newest;
+}
+
 /**
  * Compare semver versions. Returns:
  * - negative if a < b
@@ -922,11 +1046,31 @@ export async function runUpdateCommand(opts: { force: boolean; check: boolean })
 
 	if (comparison <= 0 && !opts.force) {
 		console.log(chalk.green(`${theme.status.success} Already up to date`));
+		// npm is this updater's install channel, but GitHub Releases is where the
+		// pipeline publishes first — diverging means the npm publish job is still
+		// running or died (or npm credentials were missing and the publish
+		// silently no-oped). Say so instead of leaving "Already up to date" as
+		// the only signal after a visibly tagged release.
+		const laggedVersion = detectRegistryLag(release.version, await fetchGitHubReleases());
+		if (laggedVersion) {
+			console.log(
+				chalk.yellow(`GitHub has release v${laggedVersion}, but the npm registry still serves ${release.version}.`),
+			);
+			console.log(
+				chalk.yellow(
+					`The npm publish for v${laggedVersion} has not landed (release pipeline still running or failed); try again in a few minutes.`,
+				),
+			);
+		}
 		return;
 	}
 
 	if (comparison > 0) {
 		console.log(chalk.cyan(`New version available: ${release.version}`));
+		const notes = selectReleaseNotesInRange(await fetchGitHubReleases(), VERSION, release.version);
+		if (notes.length > 0) {
+			console.log(chalk.dim(`\n${formatReleaseNotes(notes)}\n`));
+		}
 	} else {
 		console.log(chalk.yellow(`Forcing reinstall of ${release.version}`));
 	}

package/src/config/settings-schema.ts

@@ -285,7 +285,7 @@ const EMPTY_STRING_ARRAY: string[] = [];
 const EMPTY_STRING_RECORD: Record<string, string> = {};
 const EMPTY_NUMBER_RECORD: Record<string, number> = {};
 const DEFAULT_CYCLE_ORDER: string[] = ["smol", "default", "slow"];
-const DEFAULT_TOOL_CALL_LOOP_EXEMPT_TOOLS: string[] = ["job", "irc"];
+const DEFAULT_TOOL_CALL_LOOP_EXEMPT_TOOLS: string[] = ["job", "irc", "subagent"];
 const EMPTY_MODEL_TAGS_RECORD: ModelTagsSettings = {};
 const HINDSIGHT_RECALL_TYPES_DEFAULT: string[] = ["world", "experience"];
 export const DEFAULT_BASH_INTERCEPTOR_RULES: BashInterceptorRule[] = [
@@ -414,6 +414,18 @@ export const SETTINGS_SCHEMA = {
 			condition: "advisorEnabled",
 		},
 	},
+	"advisor.includeThinking": {
+		type: "boolean",
+		default: true,
+		ui: {
+			tab: "model",
+			group: "Advisor",
+			label: "Advisor Sees Thinking",
+			description:
+				"Include the primary agent's thinking blocks in advisor transcript updates. Some provider classifiers (e.g. Anthropic's reasoning_extraction) refuse payloads that replay thinking as text; the advisor also auto-disables this for the session after such a refusal.",
+			condition: "advisorEnabled",
+		},
+	},
 	"advisor.syncBacklog": {
 		type: "enum",
 		values: ["off", "1", "3", "5"] as const,
@@ -1592,7 +1604,7 @@ export const SETTINGS_SCHEMA = {
 			tab: "interaction",
 			group: "Startup & Updates",
 			label: "Check for Updates",
-			description: "Check for jeopi updates on startup",
+			description: "Check for jeopi updates on startup and periodically during long sessions",
 		},
 	},
 

package/src/extensibility/plugins/loader.ts

@@ -6,11 +6,12 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getPluginsDir, getPluginsLockfile, isEnoent } from "jeopi-utils";
+import { getPluginsDir, getPluginsLockfile, isEnoent, logger } from "jeopi-utils";
 import { getConfigDirPaths } from "../../config";
 import { resolveActiveProjectRegistryPath } from "../../discovery/helpers";
 import { installLegacyPiSpecifierShim } from "./legacy-pi-compat";
 import { normalizePluginRuntimeConfig } from "./runtime-config";
+import { resolvePluginTrust } from "./trust";
 import type {
 	InstalledPlugin,
 	PluginManifest,
@@ -443,10 +444,35 @@ export function resolvePluginExtensionPaths(plugin: InstalledPlugin): string[] {
 // =============================================================================
 
 /**
- * Get all tool paths from all enabled plugins.
+ * `getEnabledPlugins` filtered down to plugins the user has trusted (or
+ * explicitly denied) via {@link resolvePluginTrust}. Plugin code executes via
+ * native `import()` with full `exec`/API access, so — unlike user-authored
+ * `.jeopi/tools/` etc., which are trusted by construction — third-party
+ * plugin code must clear a trust-on-first-use gate before any of its
+ * tools/hooks/commands/extensions are loaded. Untrusted/denied plugins are
+ * silently skipped here (not thrown): the plugin stays installed and its
+ * non-code capabilities (skills/rules, discovered separately) are unaffected.
  */
-export async function getAllPluginToolPaths(cwd: string): Promise<string[]> {
+async function getTrustedEnabledPlugins(cwd: string): Promise<ScopedInstalledPlugin[]> {
 	const plugins = await getEnabledPlugins(cwd);
+	if (plugins.length === 0) return plugins;
+	const trusted: ScopedInstalledPlugin[] = [];
+	for (const plugin of plugins) {
+		const isTrusted = await resolvePluginTrust({ name: plugin.name, version: plugin.version });
+		if (isTrusted) {
+			trusted.push(plugin);
+		} else {
+			logger.debug("plugin code load skipped: not trusted", { name: plugin.name, version: plugin.version });
+		}
+	}
+	return trusted;
+}
+
+/**
+ * Get all tool paths from all enabled *and trusted* plugins.
+ */
+export async function getAllPluginToolPaths(cwd: string): Promise<string[]> {
+	const plugins = await getTrustedEnabledPlugins(cwd);
 	const paths: string[] = [];
 
 	for (const plugin of plugins) {
@@ -457,10 +483,10 @@ export async function getAllPluginToolPaths(cwd: string): Promise<string[]> {
 }
 
 /**
- * Get all hook paths from all enabled plugins.
+ * Get all hook paths from all enabled *and trusted* plugins.
  */
 export async function getAllPluginHookPaths(cwd: string): Promise<string[]> {
-	const plugins = await getEnabledPlugins(cwd);
+	const plugins = await getTrustedEnabledPlugins(cwd);
 	const paths: string[] = [];
 
 	for (const plugin of plugins) {
@@ -471,10 +497,10 @@ export async function getAllPluginHookPaths(cwd: string): Promise<string[]> {
 }
 
 /**
- * Get all command paths from all enabled plugins.
+ * Get all command paths from all enabled *and trusted* plugins.
  */
 export async function getAllPluginCommandPaths(cwd: string): Promise<string[]> {
-	const plugins = await getEnabledPlugins(cwd);
+	const plugins = await getTrustedEnabledPlugins(cwd);
 	const paths: string[] = [];
 
 	for (const plugin of plugins) {
@@ -485,10 +511,10 @@ export async function getAllPluginCommandPaths(cwd: string): Promise<string[]> {
 }
 
 /**
- * Get all extension module paths from all enabled plugins.
+ * Get all extension module paths from all enabled *and trusted* plugins.
  */
 export async function getAllPluginExtensionPaths(cwd: string): Promise<string[]> {
-	const plugins = await getEnabledPlugins(cwd);
+	const plugins = await getTrustedEnabledPlugins(cwd);
 	const paths: string[] = [];
 
 	for (const plugin of plugins) {